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Blind quantum computation (BQC) allows a client (Alice), who only possesses relatively poor quantum de¬ 
vices, to delegate universal quantum computation to a server (Bob) in such a way that Bob cannot know Alice’s 
inputs, algorithm, and outputs. The quantum channel between Alice and Bob is noisy, and the loss over the long¬ 
distance quantum communication should also be taken into account. Here we propose to use decoherence-free 
subspace (DFS) to overcome the collective noise in the quantum channel for BQC, which we call DFS-BQC. 
We propose three variations of DFS-BQC protocols. One of them, a coherent-light-assisted DFS-BQC protocol, 
allows Alice to faithfully send the signal photons with a probability proportional to a transmission rate of the 
quantum channel. In all cases, we combine the ideas based on DFS and the Broadbent-Fitzsimons-Kashefi pro¬ 
tocol, which is one of the BQC protocols, without degrading unconditional security. The proposed DFS-based 
schemes are generic and hence can be applied to other BQC protocols where Alice sends quantum states to Bob. 


I. INTRODUCTION 

A first-generation fully fledged quantum computer will 
eventually be realized by a large enterprise or a government. It 
is supposed that due to its scale and/or the difficulty of main¬ 
taining it, clients who want to utilize the quantum computer 
will delegate quantum computation to the quantum server us¬ 
ing poor quantum devices that are insufficient for universal 
quantum computation. In such a situation, the clients can em¬ 
ploy blind quantum computation (BQC) to guarantee the un¬ 
conditional security of their inputs, algorithms, and outputs of 
quantum computations j 1 420(1 . 

The early BQC protocol proposed by Childs is based on the 
circuit model and assumes a client (Alice) possesses a quan¬ 
tum memory H. Broadbent, Fitzsimons, and Kashefi (BFK) 
proposed a BQC protocol based on the idea of measurement- 
based quantum computation (MBQC) (21], which success¬ 
fully allows Alice to be almost classical, only requiring a 
preparation of rotated qubits and the ability to access a quan¬ 
tum channel @]. The BFK protocol has stimulated the com¬ 
munity and has led to a series of proposals of BQC based 
on the idea of MBQC (Ml [H El Gl [H El ill ■ Fur¬ 
thermore, proof-of-principle experiments have already been 
demonstrated ll22ll23ll . 

In single-server BQC protocols DHl llEMi, Alice and a 
quantum server (Bob) need to execute quantum communica¬ 
tion between them. In such protocols, a quantum channel be¬ 
tween Alice and Bob is assumed to be ideal as long as quan¬ 
tum states are transmitted without loss. This is an undesir¬ 
able assumption, since an actual quantum channel has noise. 
Moreover, it is known that quantum communication is essen¬ 
tial for BQC jH. 

There are several ways to fix this issue, as follows. First, 
Alice and Bob may perform entanglement distillation to share 
high-fidelity Bell pairs between them. However, in such a 
case, Alice has to perform quantum operations, which are too 
demanding in the BQC scenario. Second, the parties may 
employ fault-tolerant topological BQC on Bob’s fully fledged 
quantum computer to correct errors during the quantum com¬ 
munication 180. While the threshold value 0.43% of the error 


rate per gate would be high enough for the fully fledged quan¬ 
tum computer on Bob’s side, it seems to be too low to tol¬ 
erate the noise introduced during the long-distance quantum 
communication. Third, the parties may utilize double-server 
BQC id , where two servers initially share nonmaximally en¬ 
tangled states due to the noise in the quantum channel, no 
quantum communication is required between Alice and two 
servers, and they employ entanglement distillation between 
two servers. However, in the double-server BQC protocol, 
any communication between two servers is prohibited. If two 
quantum servers communicate with each other, Alice’s secrets 
are completely exposed to them. Accordingly, a complete so¬ 
lution of the noise problem of the quantum channel in BQC is 
still open. 

In this paper, we resolve the noise problem in the quan¬ 
tum channel for BQC, specifically for the collective noise, 
which is a prototypical model of noise, as confirmed in ex¬ 
periments 125], when photons are commonly used as carriers 
of information in quantum communication, and optical fibers 
are employed as quantum channels. Decoherence-free sub¬ 
space (DFS) has been known to be immune to such noise |[26l — 
1301 and its validity has already been demonstrated experimen¬ 
tally HM1. 

Here we propose protocols to employ DFS for BQC, 
namely, DFS-BQC protocols. We show that parties can pro¬ 
tect the quantum state sent from Alice to Bob against an arbi¬ 
trary collective noise with few changes on Alice’s side and 
quantum communication parts of the BFK protocol, while 
Bob needs to perform additional operations. Since the BFK 
protocol has unconditional security against Bob’s arbitrary op¬ 
erations, this construction substantially relaxes the proof of 
blindness of DFS-BQC protocols. 

We propose three variations of DFS-BQC protocols. The 
first protocol is an entanglement-based DFS-BQC protocol, 
where Alice is required to be able to generate a Bell pair. 
However, in the BQC scenario, this requirement is too de¬ 
manding for Alice. The second one, a single-photon-based 
DFS-BQC protocol successfully replaces the entanglement 
generation process with a single-photon source and a post¬ 
selection on Bob’s side. The third one is a coherent-light- 


2 


assisted DFS-BQC protocol, where a single photon for utiliz¬ 
ing the DFS in the second one is replaced by a coherent-light 
pulse. This replacement improves the efficiency of this proto¬ 
col under a lossy quantum channel. These protocols require 
only linear optics to Alice after the state preparation and do 
not employ single-photon interference. 

This paper is organized as follows: In Sec. II, we intro¬ 
duce a practical noise model in the transmission channel, the 
procedure of the BFK protocol, and the essential properties 
of the BQC protocols (correctness and blindness). In Sec. Ill, 
we propose the entanglement-based DFS-BQC protocol as the 
first protocol. In Sec. IV, we propose the single-photon-based 
DFS-BQC protocol as the second protocol. In Sec. V, we 
propose the coherent-light-assisted DFS-BQC protocol as the 
third protocol. Section VI is devoted to the conclusion. In Ap¬ 
pendices A, B, and C, we provide the details of the proof of 
correctness for each protocol. In Appendix D, we provide the 
detailed calculation of the success probability of the coherent- 
light-assisted DFS-BQC protocol. 

II. SETUP 

We employ the polarization degree of freedom of a single 
photon as a qubit a\H) rn +(3\V) m (|a| 2 +|/3| 2 = 1, a, (3 £ C), 
where m indicates the spatial mode, and H) and V) repre¬ 
sent the horizontal ( H ) and vertical (V) polarization states of 
the single photon, respectively. We may switch the notation 
\H) and |V) to |0) and |1), respectively, to define the Pauli 
operators and the controlled-NOT (CNOT) gate. Instead of 
sending such a photonic qubit directly, Alice sends the pho¬ 
tonic qubit through optical fibers of the transmission rate T 
after splitting them into two spatial modes S and L by a polar¬ 
izing beam splitter (PBS), as shown in Fig. □ & If the opti¬ 
cal fibers are ideal, the state after Bob’s PBS is a\H) S +[3\V) s . 
Photons are sent from Alice to Bob at a certain interval, and 
the photon in the ?'th time bin of mode m £ {S', s, L, 1} is 
denoted by |-)m ■ Nonlinear interactions for photons are in¬ 
trinsically quite weak in the optical fiber, and the fluctuation 
of the optical fiber is typically slow. Therefore, we can model 
the noise of the optical fiber by unknown collective unitary op¬ 
erators Ug and Us acting on the polarization qubit in modes 
S and L, respectively. Since the input photon in mode S and 
L is H and V polarized, respectively, the set of complex pa¬ 
rameters S = (a, b, c, d ) defined by 

U s \H)s = a\H) s + b\V) s , U L \V) L = c\H) L + d\V) L , 

and |a| 2 + |6| 2 = |c| 2 + \d\ 2 = 1 is enough to model the 
collective unitary error of the quantum channel |f29f l. The par¬ 
ties will extract the DFS from photons in different time bins, 
where we assume that the time difference is sufficiently small 
compared to the fluctuation time of S. 

The BFK protocol runs as follows J3j]: (1) Alice sends n 
rotated qubits {|+^) = (|0) + e ie3 |l))/-\/2}” = i to Bob. Here, 
9j is randomly chosen such that 6j £ {kn/i\k £ Z, 0 < k < 
7}. (2) Bob generates a brickwork state according to Alice’s 
instruction M, which tells the parties how the brickwork state 
is generated from the rotated qubits. (3) Bob performs the 



FIG. 1: The quantum channel between Alice and Bob. The 
boxes with the diagonal line indicate the polarizing beam 
splitters (PBSs). 


measurement on the jth qubit according to the measurement 
angle = 8j + <t>b + rjir sent from Alice. Here, 0' is the 
angle by which Alice wants to perform the measurement, and 
Tj £ {0,1} is a random number. Bob sends the measurement 
outcome to Alice. Alice and Bob repeat these procedures to 
complete MBQC. 

Two essential properties of the BQC protocols are correct¬ 
ness and blindness. A BQC protocol is correct if and only 
if the output of the protocol is Alice’s desired one as long as 
Alice and Bob follow the procedure of the protocol faithfully. 
A protocol is blind if and only if Bob cannot know any infor¬ 
mation about Alice’s inputs, algorithm, and outputs whenever 
Alice follows the procedure of the protocol. 

III. ENTANGLEMENT-BASED PROTOCOL 

The first DFS-BQC protocol runs as follows: (1) Al¬ 
ice generates the Bell pair |\I>+}M = (|AT)( 2l_1 )|I/)^ 2 ^ + 
\V)^-U\h)^)/V2, which is in the DFS against the col¬ 
lective dephasing. (2) Alice randomly rotates the ( 2i — l)th 

photon of |\P+)W by R z (9i) = e ~ l ~^ (9i £ {/e7r/4|fc £ 
Z. 0 < k < 7}). Alice sends the rotated Bell pair to Bob 
by using the quantum channel. (3) Bob performs the quan¬ 
tum nondemolition (QND) measurement of the photon num¬ 
bers + rim l \ where n indicates the 

photon number of the fcth time bin and the spatial mode 
ui |[39f l. When the outcome of the QND measurement is 
(iVi 2i_1>) ,iV/ 2i_1 ’ 2i) ) = (2,0), (0,2), or (1,1), Bob tells 
Alice that the ith Bell pair is successfully sent from Alice to 
Bob. According to the measurement outcome. Bob performs 
an appropriate operation so as to extract the signal qubit pro¬ 
tected by the DFS, and they proceed to step (4). When Bob 
obtains other measurement outcomes, this protocol fails, and 
they return to step (1). (4) Alice and Bob repeat steps (l)-(3) 
until these steps succeed n times. (5) The remaining steps are 
the same as steps (2) and (3) of the BFK protocol yfl. 

Below, we will show correctness. 

Proof: The QND measurement in step (3) eliminates the 
effect of the photon loss, and hence we consider only cases in 
which two photons arrive on Bob’s side. The state after Bob’s 
PBS is {(a\H) {2l - 1] + b\V)\ 2l ~ 1] )(c\H)\ 2i) + d\V) {2i) ) + 
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e i9i (c|-ff)[ 2i-1) + d\V) {2l - 1] ){a\H) {2i) + b\V)\ 2i) )}/V2. 
There are three successful cases according to Bob’s mea¬ 
surement outcomes in step (3) as follows: (i) In the case 
of (A^ 2 * _ 1 > 2 *) j jy^ 2 * -1 ’ 2 ®)) = ( 2 , 0 ), the state is pro¬ 
jected to + e i6i |F)i 2i_1) \H)^)/y/2 

with probability \ad\ T 2 . (ii) In the case of 

(ivj 2 * -1,2i \ AT^ 2 * -1 ’ 2 ^) = ( 0 , 2 ), the state is projected to 
(|-ff)j 2<-1) |V)j 2i) + e~ i9 '\ y); (2i_1) |fT)[ 2i) )/ v / 2 with proba¬ 
bility \bc\ 2 T 2 . (iii) In the case of (ivi 2 * 1 , 2 *\iV ^ 21 1,2 *- ) ) = 
(1,1), the state is projected to {ac(\H)^ 2t ^\H)^ + 

+ bd( |y)f i_ 1 ) |y}i 2i) + 

e l 0 i |I / )i 2 l_ 1 ^|V r ); 2 ^)}/i/ 2 (|ac | 2 + \bd\ 2 ) with proba¬ 
bility (|ac | 2 + |M| 2 )T 2 . In any cases, Bob obtains 

1*8,)® = (|Jy)i 2 i - 1 } |y)i 2i) +e iei \V)f i - 1) \H) {2i) )/V2by 

applying an appropriate operation according to the measure¬ 
ment outcome. Particularly in case (iii), where two photons 
are detected on both modes. Bob transforms the state by 
using t/p.f. = \H)s(H\ s + \H)i(V\, + |V) s (i7| ; + |V')i<V|, 
and performs the QND measurement again. Finally, Bob 
performs the CNOT gate A(X) to |'I' 0 i }i I ' > to obtain the 
desired qubit |+g,) as the first (control) qubit. This state is 
the same as the state of the rotated qubit in step ( 1 ) of the 
BFK protocol (see Appendix A). ■ 

The total success probability becomes T 2 , which means 
that Bob deterministically obtains the desired qubit up to the 
photon loss. 

Next, we will show blindness. 

Proof: The information sent from Alice to Bob is 

n, M, and where Upss represents the op¬ 
eration by the PBS. In addition, according to the message m 
that tells whether or not the protocol succeeds, Alice needs to 
decide whether or not she sends additional Bell pairs. Since 
the measurement angle Q is shifted by r, tt with a random vari¬ 
able r.i G {0,1}, the quantum state sent from Alice to Bob is 
written, from Bob’s point of view, as 

N ' 1 i 

i= 1 r^—0 

N' i(2i-l) 

= (g) C/pbsA(X)(- 0 | V) ^ (Vj ^ )A(X)Up BS ■ 

i =1 

Here, N' is the actual number of Bell pairs sent from Alice to 
Bob, and depends on only n and m. The above state does 
not depend on any information about Alice’s inputs, algo¬ 
rithm, and outputs, and hence the entanglement-based DFS- 
BQC protocol has blindness. ■ 

IV. SINGLE-PHOTON-BASED PROTOCOL 

We propose a single-photon-based DFS-BQC protocol, 
where the extraction of the DFS against the collective dephas¬ 
ing (DFS extraction, DFSE) is utilized in order to remove the 
necessity of the entanglement generation on Alice’s side |[29]. 


In this protocol, all Alice has to do is the same as what she has 
to do in the BFK protocol. 

The DFSE for two photons proceeds as follows: (1) Apply 
A(X) to two photons. (2) Measure the target qubit in the Z 
basis. If the outcome implies |V), then the remaining con¬ 
trol qubit comes from the DFS, and the DFSE is successfully 
done. Otherwise, the DFSE fails. 

The single-photon-based DFS-BQC runs as follows: (1) 
Alice generates 2 N rotated photons {\+9i)^} 2 ^2N(h-i)+v 
and sends them to Bob by using the quantum channel. Here, 
9i is chosen randomly, similarly to the previous case, and h 
is the number of the repetition of steps (l)-(4). The number 
of photons 2N is chosen such that all 2 N photons experience 
the collective noise. In other words, N is determined by the 
time scale of the fluctuation of the optical fiber and the repe¬ 
tition rate of the single-photon source. (2) Bob performs the 
QND measurement of the photon number n s + n\ . Bob 
constructs \M/2\ pairs of the photons in fcth and fc'th time 

bins with n{^ + n= 1 and ni k ^ + n\ k ■* = 1, where M is 

d) (i) 

the total number of time bins satisfying n s + n\ = 1. (3) 
Bob performs the QND measurement of the photon number 

N^ X) . If (!Vi fc ’ fc/) , 7V/ fc ’ fc,) ) = (2, 0) or (0, 2), they proceed 
to step (4). On the other hand, if ( Ns k ’ k \ jv/ fc,fc ^) = (1,1), 

Bob performs U p .f. 0 U p .{. to the output. Then, he per- 

r (k k') 

forms the QND measurement of the photon number Nm ’ 
again. If the outcome of the second QND measurement satis¬ 
fies ( Ng k ’ k \ N[ k ’ k •*) = (2,0) or (0,2), they proceed to step 
(4). If the outcome of the second QND measurement satis¬ 
fies that ( Ng k ' k \N[ k,k ^) = (1,1), they discard the pair and 
perform step (3) over again. If all \_M /2J pairs are consumed, 
they return to step (1). (4) Bob performs the DFSE for the pair. 
If the DFSE succeeds for the fcth and fc'th photons, | +e k -e k ,) 
is obtained, and Bob tells Alice that it succeeds. If the DFSE 
fails, they return to step (3) to obtain another pair. (5) Alice 
and Bob repeat (1)—(4) until these steps succeed n times. (6) 
The remaining steps are the same as steps (2) and (3) of the 
BFK protocol. 

The correctness of this protocol is proven in the same way 
as the entanglement-based DFS-BQC protocol, except that the 
extraction of the desired qubit becomes probabilistic. Since 
the success probability of the DFSE is 1/2, the probability 
of obtaining the desired qubit from 2 N photons is calculated 
to be Y?m= 0 Cm)T M (1 ~ T) 2N ~ M { 1 - 1 / 2 L m / 2 J), wh ich 
rapidly approaches to unity for sufficiently large N, as shown 
in Fig.[2](see Appendix B). 

Next, we will show blindness. 

Proof: The quantum state sent from Alice to Bob is written, 
from Bob’s point of view, as 

JV' 1 1 N' t (*) 

2 UpBS | +6i) ^ (+0i | ^ C^PBS = (££) ^PBS ^ ^PBS' 

1= 1 Ti=0 2 = 1 ~ 

Here, N' is the actual number of photons sent from Alice to 
Bob, and depends on only N, n, and m. The above state does 
not depend on any information about Alice’s inputs, algo- 
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FIG. 2: The success probabilities for the entanglement-based 
(blue line), the single-photon-based (cyan dashed line for 
N = 15 and green dashed line for N = 1), and the 
coherent-light-assisted (red dotted line for fi = 1 /T and 
|a| = |d| = l/\/2) DFS-BQC protocol (see Appendix D). 


rithm, and outputs, and hence the single-photon-based DFS- 
BQC protocol has blindness. ■ 

V. COHERENT-LIGHT-ASSISTED PROTOCOL 

The success probability of the single-photon-based DFS- 
BQC protocol scales 0(T 2 ). If the quantum channel is very 
lossy, the success probability of this protocol becomes very 
low. In order to improve the efficiency, we propose a coherent- 
light-assisted DFS-BQC protocol 130. [38ll . 

The coherent-light-assisted DFS-BQC protocol 

runs as follows: (1) Alice generates a rotated pho¬ 
ton and a coherent-light pulse |= 

e_/i / 2 X))p=o (y/p) n where the subscript + 

indicates the polarization |+) = |+o) and the phase of 
the coherent light is fixed to 0 for simplicity. 9i is chosen 
randomly, similarly to the previous case. She sends these 
two states alternately to Bob by using the quantum channel. 

(2) Bob performs the QND measurements of the photon 
number ni 2 * ^ + n\ l 1; and n > 2 ^ + n\ 2l ' > for the (2 i — l)th 
photon and the 2ith coherent light, respectively. If any of the 
events with ii' 21 ^ + n[ 2t ^ = 1 and + n[ 2l ' > > 1 are 
obtained, they proceed to step (3). Otherwise, they return to 
step (1). (3) Bob performs almost the same procedure as step 

(3) of the single-photon-based protocol with M = 2 for the 

(2 i — l)th photon and a photon which is extracted from the 
2/th Fock state. Unlike step (3) of the single-photon-based 
protocol, if the outcome of the second QND measurement 
satisfies that (TV,) 2 * 1 ' 2l ' > , iv/ 2 * = (1,1), he measures 

the mode of the 2ith photon nondestructively and flips the 
polarization of the 2ith photon. After that, they proceed to 
step (4). (4) Bob performs the DFSE for the pair of (2 i — l)th 
and 2ith photons. If the DFSE succeeds, 1+^} is obtained, 
and he tells Alice that it succeeds. If the DFSE fails, they 
proceed to step (5). (5) Bob performs the QND measurement 


(2 i) 

of the photon number rim . According to the outcome(s) in 
step (3), he discards the photon in mode l, s, or does nothing. 
Then, he repeats the DFSEs with the output of the previous 
DFSE and one of the remaining photons. When the number 
of the successful DFSEs exceeds that of the failure DFSEs, 
l+gj is obtained, and he tells Alice that it succeeds. If all 
remaining photons are consumed, they return to step (1). (6) 
Alice and Bob repeat steps (l)-(5) until these steps succeed n 
times. (7) The remaining steps are the same as steps (2) and 
(3) of the BFK protocol. 

To obtain an intuition of correctness, let us look at 
the following example case (a rigorous proof of correct¬ 
ness is given in Appendix C). Alice prepares the state 
I +9 i ) ( ' 2l ~ 1 ' > ® If) + Z ^ which is sent to Bob by using 
the quantum channel. Suppose Bob obtains + 

h\ 2i ~ 1) = 1 in step(2) and (Ar s (2i_1 ’ 2i) , = 

(2, 0) in step (3). Then, the state of two photons becomes 

(a|iT)i 2i-1) + e^d|y)i 2i " 1) )/V|a| 2 + Ml 2 ® {a\H) (2i) + 
d|V)i 2 ^)/\/l a l 2 + \d\ 2 . In step (4), if the DFSE fails, the 

state becomes (a 2 \H)^ 2l ~ 1 ' > +e l9i d 2 \V)i 2l ~ 1 ^)/^/\a\ 4 + \d\ A . 
Then, he repeats the DFSEs in step (5). After that, if 
the DFSE succeeds twice in a row, the state changes as 
follows: {a 2 \H) <y2l ~ 1 ' > + e l6li d 2 | V)i 2l_1 ^)/\/M 4 + |d| 4 —> 
(a|F)i 2i_1) +e l9 'd\V) {2l - 1) )/^/\a\ 2 + \d\ 2 (| 7T)i 2i_1) + 
e ie *\V) {2i -V)/V2=\+e i ) {2i - 1) . 

The success probability is calculated by considering a ran¬ 
dom walk with an absorbing boundary. When the mean pho¬ 
ton number of the coherent light as an ancilla // is l/T, the 
success probability becomes 0(T), as shown in Fig. [2] (The 
derivation of the success probability is given in Appendix D.) 
Similar to the single-photon-based DFS-BQC protocol, the 
success probability of the coherent-light-assisted DFS-BQC 
protocol can be improved by increasing the number of pairs of 
the single photon and the coherent-light pulse as long as they 
experience the collective noise. The above protocol is done 
using one of the single photons and one of the coherent-light 
pulses or another one of the single photons among them. 

Next, we will show blindness. 

Proof: The information sent from Alice to Bob is 

f/pBs|+e i } ( ' 2l-1) , 6pBs|At} + ^ n, M, and The quantum 
state sent from Alice to Bob is written, from Bob’s point of 
view, as 

(g) E it>PBs(i+ ei ) ( 2 i - 1 ) (+ e j (2i - 1) ® 

i=i n =0 

N' t (2i—1) 

-(g)' PBS(' al/^Mf^PBS- 

i=l 

Here, N 1 is the actual number of photons sent from Alice to 
Bob, and depends on only n and m. The above state does not 
depend on any information about Alice’s inputs, algorithm, 
and outputs, and hence the coherent-light-assisted DFS-BQC 
protocol has blindness. ■ 

VI. CONCLUSION 


PBS 
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We have proposed three kinds of DFS-BQC protocols, 
which tolerate the collective noise in the quantum chan¬ 
nel. While we have considered the BFK protocol only, it 
is straightforward to apply the proposed DFS-based schemes 
for other BQC protocols, such as the topological BQC proto¬ 
col i and unconditionally verifiable BQC protocol Q], with¬ 
out degrading their unconditional security. Moreover, while 
we have assumed the collective unitary noise and loss as the 
imperfection of the quantum channel, it is straightforward to 
extend the proposed protocols to more general collective noise 
with collective Kraus operators. 
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APPENDIX A: BOB’S OPERATIONS IN THE 

ENTANGLEMENT-BASED DFS-BQC PROTOCOL 

In order to complete the proof of correctness of the 
entanglement-based DFS-BQC protocol, here we explain 
Bob’s operations employed after the QND measurements in 
step (3) of Sec. III. 

All operations are designed to obtain |4'e i }i 1 ' 1 from the 
state after the QND measurements. In case (i) with 
(iVi 2i_1,2i) ,iV/ 2<_1 ’ 2i) ) = (2,0), Bob obtains 

and hence no operation is required. In case (ii) with 
(iVj 2l-1 ’ 2i \ = (0, 2), the state is projected to 

\H) (2i ~ 1] \V)™ + e~ i6i \V)\ 2i ~ 1) | H) (2i) 

71 ' 

By applying the Pauli-A operation and the swapping opera¬ 
tion of modes l and s for two photons, he obtains 

\H)i 2i -V\V)W +e i °<\V) ( ? i - 1) \H)W f0 
-71- = l s - > -' 

In case (iii) with (TVj 2 * 1,2 *\ iv/ 2 * 1>2 ^) = (1,1), the state is 
projected to 

{ac(\H)^\H)\ 2i ^ + e^\H)f i ~ 1) \H)^) + 

bd{ |v)r- 1) |v)f ) + e ^|y)f- 1 )|y)p i) )}/V2(|ac| 2 + |M 2 ). 

By applying U pI . = \H) S (H\ S + \H)i(V\ a + |V) s <tf| ; + 
\V)i(y\i,\\z obtains 

&d(|V0< 2< - 1) |fr> J (2<) + e i9i \H)[ 2i ~ 1 ' > \V)[ 2i ^)} / \/2(\ac\ 2 + |hd| 2 ). 

Then, he further performs the QND measurement of 
the photon number JVi 2l_1,2l l and always obtains 
(i\ri 2<_1 ’ 2<) ,Ar/ 2i - 1,2<) ) = (2,0) or (0,2). The former 
case is the same as case (i), and the latter case is the same as 
case (ii). Accordingly, he obtains in any cases. 


APPENDIX B: CORRECTNESS OF THE 
SINGLE-PHOTON-BASED DFS-BQC PROTOCOL 

Here we provide a detail of the proof of correctness of 
the single-photon-based DFS-BQC protocol, where its suc¬ 
cess probability is also calculated. 

Proof: The state of the /,'th and A/th photons before QND mea¬ 
surements is given by 

{a\H)i k) + b\V) [k] ) + e ie *(c\H)\ k) + d\V ) [ s k) ) 

V2 

„ + b\V) { p) + e i9k ‘ (c\H)p + d\V)P) 

® 71 ■ 

There are four successful cases depending on the outcomes 
of the QND measurements, as follows: 

(i) The first QND measurement in step (3) of Sec. IV results 
in (Ng k ’ k \N[ k ’ k •*) = (2, 0). The state is projected to 

(a 2 \H)W\H)f) + e i6k/ ad\H)W\V)i k,) + 
e Wk ad\V)i k) \H)i k ' ] + e i(9k+ek,) d 2 \V)i k) \V)i k,) )/(\a\ 2 + \d\ 2 ) 

with probability (|a| 2 + |d| 2 ) 2 /4. If the DFSE succeeds, 
then Alice’s desired qubit (| H) + e l ^ 9k ~ ekl ' > \V))/\/2 is 
prepared. The success probability of the DFSE is calcu¬ 
lated to be 2|ad| 2 /(|a| 2 + |d| 2 ) . 

(ii) The first QND measurement in step (3) results in 
(. Ns k ' k \N[ k ' k ■*) = (0, 2). The state is projected to 

(b 2 \V) (k) \V) ik,) + e iek 'bc\V) {k) \H) (k,) + 

e i0k bc\H)f ) \V) ( f ) + e i{ek+6k,) c 2 \H) ( i k) \H) {k,) )/(\b\ 2 + |c| 2 ) 

with probability (|6| 2 + |c| 2 ) 2 /4. If the DFSE suc¬ 
ceeds, (\H)+e^ 9k '~ 9k ^\V))/\/2is prepared. ThePauli- 
X operation is applied in order to flip the sign of the 
phase, and (| H) + e l ^ 9k ~ 9kl ' > \V)) / y/2 is obtained. The 
success probability of the DFSE is calculated to be 

2|6c| 2 /(|6| 2 + |c| 2 ) 2 . 

(iii) The first QND measurement in step (3) results in 
(_/vj fc,fc ), jy(k,k ^ The s t a ( e j s projected to 

ab\H)^\V) [k,) + e i9k 'ac\H)W\H) i l k ' ) + 

ab\V) (k) \H) {k ' ) +e i9k 'bd\V) {k) \V) i - k ' ) + 

e i9k ac\H) {k) \H)^ +e i ^ 0k+e ^cd\H}\ k) \V)f ) + 

e l9k bd\V)i k) \V) {k,) + e i{9k+9k,) cd\V)i k) \H) {k,) 

up to normalization. By applying U p .{. 0 U p .f., Bob ob¬ 
tains 

ab\H)W\V)f ] + e i9k ' ac\H) ( ' k) \V) (k ' ) + 
ab\V) (k) \H) < - k ' ) + e i9k 'bd\V) (k) \H) (k,) + 
e i9k ac\V) {k) \H) ( s k ' ) + e i{9k+9k ' ) cd\V) {k) \H) {k ' ) + 
e i6k bd\H) {k) \V) [k,) + e i{9k+9k/) cd\H) < i k) \V)i k ''> 
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up to normalization. Bob performs the QND measure- 

(k k') 

ment of the photon number N„ t ’ again. There are two 
successful cases in case (iii), as follows: 

(iii-i) (. Ng k,k \Ni k ’ k = (2,0). The state is projected 
to 

\H) (k) \V)i k,) + H) {k,) 

V2 

The DFSE for this state always succeeds, and 
(\H) + e l ^ ek ~ 0k, ' > \V)) / ^/2 is prepared. The overall 
success probability of the present case is calculated 
to be |ac| 2 /2. 

(iii-ii) (Ng k ' k \ N^ k,k = (0,2). The state is projected 
to 

\H) {k) \V) {k ' ] + e ^ e ^- e ^\V) (k) \H) {k ' ] 

71 ' 

The DFSE for this state always succeeds, and 
(\H) + e*^'-^)|T/))/V2is prepared. The Pauli- 
X operation is applied in order to flip the sign 
of the phase, and (|iT) + e^ ek ~ 9k ^\V))/y/2 is 
obtained. The overall success probability of the 
present case is calculated to be \bd\ 2 /2. 


Accordingly, if the DFSE succeeds, | +g k -e k ,) is prepared on 
Bob’s side. ■ 

We derive the probability of the successful preparation of 
Alice’s desired qubit with 2 N single photons, which experi¬ 
ence the same unitary noise and the photon loss. First, we 
calculate the success probability of the DFSE for a pair of two 
photons. This is done by summing all success probabilities 
shown in the above proof of correctness: 

(|q| 2 + M 2 ) 2 2M 2 (\b\ 2 + |c| 2 ) 2 2\bc\ 2 

4 (|a| 2 + |d| 2 ) 2 4 (|6| 2 + |c| 2 ) 2 

|ac| 2 \bd\ 2 1 

2 H 2 “ 2 

This indicates that the net failure probability of the DFSE for 
each pair of two photons is 1/2. Since Alice sends 2 N pho¬ 
tons by using the quantum channel with the transmission rate 
T, the probability that M photons reach Bob’s side is calcu¬ 
lated to be ( 2 ^)T m ( 1 — T) 2N M . Since the DFSE is done 
for each pair of two photons independently, the success prob¬ 
ability of this protocol is given by 



T m (1 — T) 


2 N-M 




APPENDIX C: CORRECTNESS OF THE 
COHERENT-LIGHT-ASSISTED DFS-BQC 
PROTOCOL 


Here we provide the proof of correctness of the coherent- 
light-assisted DFS-BQC protocol. 

Proof: From correctness of the single-photon-based DFS- 
BQC protocol, it is proven that if the DFSE succeeds in step 
(4) of Sec. V, a desired qubit is prepared. Thus, without loss 
of generality, we consider only the case that Alice and Bob 
proceed to step (5). In order to prove correctness, we have 
to consider three cases depending on the outcome(s) of the 
QND measurement(s) in step (3). 


(i) The first QND measurement in step (3) results in 
(W s (2i_1 ’ 2i) , jv/ 2i-1,2i) ) = (2,0), and the DFSE fails in 
step (4). First, Bob discards the photons that exist in 
mode l. Bob repeats the same procedure as step (4), that 
is, the DFSE for the output of the previous DFSE and one 
of the remaining photons extracted from the coherent 
light. Suppose the DFSEs succeed and fail N T i g ht(> 0) 
and N] e f t (> 1) times, respectively. In such a case, the 
state is transformed into 

a l+Arieft^tV rig ht|jj^(2i-l) _|_ gi6 l » a Afright^l+A r ieft|y^(2i-l) 

up to normalization. If iV r ight = 1 +Ni e { t is satisfied, the 
above state becomes (|7T)i 2l_1 ' ) +e* 0i |V’)g 2 * _1 ^)/\/2 = 

|+ 0 i)s 2? l ' ) - In other words, when the number of the suc¬ 
cessful DFSEs exceeds that of the failure DFSEs, 1+^) 
is obtained. 

(ii) The first QND measurement in step (3) results in 
(iVi 2i_1 ’ 2<) , iV/ 2i_1>2i) ) = (0, 2), and the DFSE fails in 
step (4). First, Bob discards the photons existing in mode 
s. Bob repeats the DFSE, similarly to the above case (i). 
Suppose the DFSEs succeed and fail N r - lg ht(> 0) and 
N\ e {t(> 1) times, respectively. In such a case, the state 
is transformed into 

& l+tV,eft c iVr ig ht|^(2i-l) + e -i$i £tv rlght c l+JVleft | y} ( 2 *-l) 

up to normalization. If N right = 1 + -/Vleft 
is satisfied, the above state becomes (|7T)j 2i_1 ' + 
e - |y) ; ( 2 * - !))/ s/2, = |+- 0 4 )| 2 * -1 ^. By performing 
the Pauli-X operation for this state, | +o i ) is obtained. In 
other words, when the number of the successful DFSEs 
exceeds that of the failure DFSEs, l+ej is obtained. 

(iii) The first and second QND measurements in step (3) re¬ 
sult in (ivj 2i-1,2l \ _/\rp i_1 ’ 21 )) = (1,1). The output of 
the second DFSE is given by 

{abm^lV)^ + IVjp^l H)W) + 

e ie 'cd{\V)^-V\H)W + \H)^~ V)f >)}/ v / 2pHW). 

After Bob measures the spatial mode of the 2ith photon 
nondestructively and performs the Pauli-A operation for 
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the 2ith photon, the above state becomes 

f a&|V)f i_1) |U)i 2i) + e iei cd\H)\ 2i ~ 1) \H)^ i) 

I TPWf ’ or 

I ab\H)¥ i - 1) \H) ( i 2i) +e iei cd\V) { s !i ~ 1) \V)\ 2i) 

{ ^\ab\ 2 + \cd\ 2 

depending on the mode of the 2ith photon. In these 
cases, the DFSE always fails. The outputs of the 
DFSE for each of these two states are (ab\V)[ 21 ^ + 
e l0i cd|ff)| 2l_1 ^)/i/|a6| 2 + |cd| 2 and {ab\H)^‘ l ~ 1 ' 1 + 

e l9i cd\V)^ ,l ~ 1 ' > )/^/\ab\ 2 + \cd\ 2 , respectively. By per¬ 
forming the Pauli-X operation and swapping the mode, 
the former state is transformed into the latter state. Thus, 
without loss of generality, the output of step (4) in this 
case is regarded as the latter state. 

(iii-i) Bob repeats the DFSE for the output of the previ¬ 
ous DFSE and one of the remaining photons ex¬ 
tracted from the coherent light on mode s. Sup¬ 
pose such DFSEs succeed and fail X right (> 0) and 
Xieft(> 1) times, respectively. In such a case, the 
state is transformed into 

a JVl e ft 6d JVright |iT}^ 2 *- 1 ) + e iei a Nlisht cd Nlett \V) ( ^ l ~ 1 ' ) 

up to normalization. When Might = A'] e f> is 
satisfied, the above state becomes (b\H)^ 1 ^ + 
e iei c|U)i 2i 1 ' > )/\/\b\ 2 + |c| 2 , and Bob discards all 
of the remaining photons extracted from the coher¬ 
ent light on mode s. Bob proceeds to step (iii-ii). 

(iii-ii) Bob repeats the DFSE for the output of the previ¬ 
ous DFSE and one of the remaining photons ex¬ 
tracted from the coherent light on mode l. Sup¬ 
pose such DFSEs succeed and fail X r ' ight (> 0) and 
NU(> 0) times, respectively. In such a case, the 
state is transformed into 

frt+^i'eftfright |^(2i-l) e i6' i j ) iV' ightc l+JV 1 ' eft |y^(2i—1) 

up to normalization. If X r ' ight = 1 + N( eit is 
satisfied, the above state becomes (|fT}i 2l_1 ' ) + 

e iei \V)£ i - X) )/V2=\+ Bi )? i ~ 1) . 

Accordingly, if the number of the successful DFSEs exceeds 
that of the failure DFSEs, |+ej is prepared on Bob’s side. ■ 

APPENDIX D: THE ^-DEPENDENCE OF THE 
SUCCESS PROBABILITY OF THE 
COHERENT-LIGHT-ASSISTED DFS-BQC 
PROTOCOL 

Here we derive the success probability of the coherent-light- 
assisted DFS-BQC protocol by using a classical biased ran¬ 
dom walk on a line with an absorbing boundary at the right 
of the starting point. We regard the successful and failure 
DFSE as “moving right” and “moving left,” respectively, in 



FIG. 3: A classical biased random walk on a line with an 
absorbing boundary, t indicates the number of trials of the 
DFSEs, which corresponds to the number of steps of the 
random walk. The numbers in each site indicate the numbers 
of paths with which a walker arrives at that site. 


the classical random walk on a line, as shown in Fig. [3] If the 
number of successful DFSEs exceeds that of failure DFSEs, 
a walker arrives at the absorbing boundary, and the protocol 
finishes successfully. Let us consider the probability that the 
walker arrives at the absorbing boundary up to a certain time 
step. When the walker arrives at the absorbing boundary at the 
time step t, the numbers of moving right N r i g ht(Q and mov¬ 
ing left JVieft(£) have to satisfy iV r jght(f) = + Thus, 

the walker cannot arrive at the absorbing boundary at an even 
number step. If the walker arrives at the absorbing boundary 
at time step (2 1' + 1), we have Might^i' + 1) = t' + 1 and 
N\ e f t (2t' + 1) = t' . When the walker moves right X r ight times 
and left Meft times, in the next step the walker moves right or 
left with the probability q^ N or (1— q^ N ), respectively. These 
probabilities depend on the cases (•) £{(i),(ii),(iii-i),(iii-ii)} in 
Appendix C and AN = Meft — Might- Now, we assume that 

dAN^-dAN-i) = (i-^AJV^AJV+i = Q ( ) , which does not 
depend on AN, is satisfied. In this case, the probability with 
which the random walk is finished at the time step (2 1! + 1) 

is given by CV^q ^ , where Cf indicates the number of 

paths with which the random walk is finished at the time step 
(2 1' + 1). Thus, we obtain the total probability that the walker 
arrives at the absorbing boundary up to time step f(> 1) as 
follows: 


E J c^’Q^'. 

t '=0 

In order to calculate CV, we utilize the original and mod¬ 
ified Pascal’s triangles, as shown in Fig. [4] The numbers of 
paths assigned at each node correspond to the numbers in the 
modified Pascal’s triangle. Because the walker finishes the 
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(a) q 

t = 0 

( b ) ® 

1 1 

i 

1 0 

1(2)1 

2 

KDO 

13 3 1 

3 

12 0 0 

1 4d)4 1 

4 

1 3(2)0 0 

1 5 10 10 5 1 

5 

1 4 5 0 0 0 

1 6 15 © 15 6 1 

6 

1 5 9(5)0 0 0 


FIG. 4: The (a) original and (b) modified Pascal’s triangles. 
Each level f in the triangles corresponds to the number of 
steps f in Fig. [3] The fth level numbers circled in red in the 
modified Pascal’s triangle correspond to the numbers of paths 
of arriving at the absorbing boundary at time step (t + 1). 


random walk whenever he arrives at the absorbing boundary, 
the numbers of paths for the absorbing boundary are written 
as 0 as an exception. Since the step just before the arrival at 
the absorbing boundary is moving right, these numbers are the 
same as the central numbers of the one step before. That is, 
Ct' corresponds to the /'th central number circled in red in the 
modified Pascal’s triangle shown in Fig.|4jb). Let P t ' = ( .() 
be the f'th central number of the original Pascal’s triangle, as 
shown in Fig. Ufa). By using P t /, CV is given by 


t' +1 t' + l 

We prove this equation by using mathematical induction. 

Proof. We define the /Cth number in the fth level of the 
original and modified Pascal’s triangles as X° K and XjN-, re¬ 
spectively. The first number in the fth level indicates the left¬ 
most number in the fth level. For later convenience, we define 
x t°,o = X™o = 0. 

First, we show that XJ'f = X° K — X° lc _ 1 (1 < /C < 
|”(f + l)/2]). From Fig. [4] this relationship is satisfied for 
f = 0, obviously. We assume that this relationship is satisfied 
for f = t. Since the properties of the original and modified 
Pascal’s triangle are satisfied for all of 1C, the equations 

y-o(m) _ yo(m) . yo(m) 

^t+ 1,K ~ -*-T,IC-l + A t, K. 

are satisfied. This leads to 


x; 


T + l./C 


= X. 


t,K- 1 


X. 


t,K 


_ yo 

— A t,/C A t,/C-2 

_ yo yo 

— ^T+l,/C — ^r+l,/C—1- 


By the principle of mathematical induction, we conclude that 

X %K = x tx - X °tx- 1 (1 < 1C < T(f + l)/2j). 


Next, we prove that Ct' = Pt' / ( t' + 1) = ( 2 ( )/(f / + 1). 
From Fig. [4] this relationship is satisfied for t' = 0, obviously. 
We assume that X 2t , T , +1 = (V + 1)X?£, r , +1 is satisfied for 
t' = t'. By using X° K = ( x .^_ 1 ) as a property of the original 
Pascal’s triangle. 


Y° 


~ 2A’2 T / +liT / + i 
= 2 (X2 T ',T' + X2 T , tT , +1 ) 

- 2 2t, + 1 Y° 

“ Z T ' + l A 2r',r'+1 


2t',t' + 1 


}*■ 

= (t' + 2)(X 2 ° t , iT , + 1 -X 2 ° t ,' T ,_ 1 ) 

= ( T ' + 2 KpT 1 X ^’ T '+ 1 + - X 2 r ’, T ’~ l ) 

= i T ' + 2)( X 2t',t'+1 + X 2t’,t’) 

= (r' + 2)X? tW+1 = (r' + 2)X™ {T , +llT , +2 


is satisfied. By the principle of mathematical induction, we 
conclude that Ct' = Pt 1 /(t 1 + 1) = ( 2 *) /(t' + 1). ■ 

So far, we have assumed that q^ N ( 1 — = (1 — 

9ajv)9ajv+i = * s satisfied- In the following, we prove 

that this assumption is satisfied in our protocol. 

Proof. When the walker moves right and left -/V r ; g ht and 
TVieft times, the probabilities that the walker moves left the 
next time in cases (i)-(iii) in Appendix C are given by 


| a |2( 2 +AA0 + | d |2(2+A N) 

(| a |2(t+AiV) + | d |2(l+AiV))(| 0 |2 + | d |2) ' ' ' W 
| fc |2(2+AiV) + | C |2(2+AAT) 

(|6|2(1+AJV) + | C |2(1+AJV)W| 6 |2 + | c |2) ' ' ' (“)’ ^ ~ U ) 
| a l+AJV 6 |2 + | cd l+AA|2 

, (|a AJV &| 2 + |cd AW | 2 )(|a| 2 + |d| 2 ) '' ' (m _ l} ' 


Then the values of QX are calculated as 


id\‘ 2 


Q ( ' } = 


\ a r + 

| be 


= Q i 


(H 5 


^| 2 ) 2 

|„|2'i2 = Q 2 


■ (i), (iii-i) 

(ii), (iii-ii). 


This means that q^ N ( 1 - q { A ) N _ 1 ) and (1 - 5^)5^+1 

do not depend on AN, and the probability that the walker 
moves right after moving left is exactly the same as that for 
the walker moving left after moving right. ■ 

We calculate the success probabilities for each case (i)-(iii). 
The flow of the coherent-light-assisted DFS-BQC protocol is 
shown in Fig. 0 We define V n (T) = e _/iT (/.iT)"/n! and 
T s = (|a| 2 + |d| 2 )/2. Here, /i and T indicate the mean photon 
number of the coherent light sent by Alice to Bob, and the 
transmission rate of the quantum channel between Alice and 
Bob, respectively. 
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FIG. 5: The flow of the coherent-light-assisted DFS-BQC 
protocol. The pairs of numbers (2,0), (0,2), and (1,1) 
represent the outcome of the first QND measurement in step 
(3) (Ng 21 1,2i \ A'/ 21 1,2l - ) ). In all three cases, when the 
walker arrives at the final absorbing boundary, l+ej is 
prepared on Bob’s side. 


(i) Since each of the signal photon and single photons ex¬ 
tracted from the coherent light is detected in mode s with 
probability T s , the success probability of the repetition 
of the DFSEs in mode s is written by 


L^J 


OO It / -| \ L 2 -I 

^Ev)EL ra-rr £ 

n=1 t =1 ' ' t' =0 

= Pi(T). 


(ii) The success probability of the repetition of the DFSEs in 
mode l is written by 


OO 71/ i \ 

T E p «( T )E r 1 la -Tsf+HTsY-* 

71=1 t= 1 ' ' 

= P2(T). 


L^J 

E ^t'Qo^Q2 t 


t' =0 


(iii) The success probability of the repetition of the DFSEs in 
modes s and l is written by 


(iii—i) 


2T^P„(T)T s (l-r s )<z l 

71=1 

OO 71 — 2 

+2Tj2‘P n (T)T s (l-T s )J2 

77 = 3 

OO 

= 2TY,'Pn{T)Ts(l-Ts)q { 


t= 1 


n — 1 


•L^J 


7?(l -TsT^-H Y CfQi' +1 


£' = 0 


•LV-iJ 

E C v ,qf-VQf 

. t "=0 


(iii-i) 


71=1 

OO 


71 — 2 


n —3 


+2 TYVn(T)Y C . l )'Tl + \l-T s ) n - t { Y CVQi 4 ' +1 


'L^J 


£' = 0 


•LV-iJ 

E 

. t "=o 


= Ps(T). 


The total success probability p(T ) of this protocol is given as The coefficient of T is 

a function of the transmission rate T by 

p(T)= Pl (T)+p 2 (T)+p 3 (T). 

In the limit of p —> oo, we obtain 

{ OO OO 

T s 2 Y + (! - T s ) 2 E CWoV 

t'=0 t'=0 

+2r s (i-r,) 9 f" i) 

( oo \ / oo 

E CVQi 4 ' +1 E C t"Qo i) Q2 t " 

t'= 0 / \t"=0 
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P(T) 

T 


\\ 2(|a| 2 + \d\ 2 - 2M 2 ) - (2 - |a| 2 - |d| 2 ) 2 ( 


+(2-|a| 2 -|d| 2 )(|a| 2 + |d| 2 )( 


||a| 2 -|d| 2 | 

2 — |a| 2 — \d\ 2 


IN 2 -N 2 I 

2 — |a| 2 — \d\ 2 

«l 2 - Ml 2 


-1 - 


-(|a| 2 + |d| 2 ) 2 (. 


|a | 2 - \d? 

|a | 2 + |d | 2 


- 1 


->)( ! 


Ml 2 


-1 


pm 

T 


which is independent of T in the large-// limit and only de¬ 
pends on |o| and |d|. Even when // is finite, it is satisfied that 
the T dependence of p(T ) is 0(T). In Fig. [6] the coefficient 
p(T)/T is plotted as a function of \a\ and |d|. Only when 
|a| = |d| is satisfied, this coefficient becomes 1 as the maxi¬ 
mum. On the other hand, when (|a|, |d|) = (1,0), or (0,1), 
this coefficient becomes 1/2 as the minimum. 



FIG. 6: The coefficient p(T)/T as a function of |a| and |d| in 
the large-// limit. 
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